[support] Documentation on using private files (restricting access to media) in D7

[camro15]

I am trying to set up a non-public image gallery using media and media gallery 
modules (access should be restricted by roles or per user). To protect the 
images in the file system I configured the private files folder and chose the 
default download method to be "served by drupal"

Unfortunately every uploaded file will get so private that even the owner is 
not able to watch it!
Uploading images to a gallery doesn't show any images. The gallery can not be 
opened from the gallery main page. Selecting an image from media management 
dialog ends up in "Access denied!.
I can't believe that this is supposed to be the desired behaviour? 

What is the concept behind public/private folders and those options for the 
default download method?
Why is the default download method defining, where the UPLOADED files are stored 
(pivate folder if served by Drupal vs. public folder when served by 
webserver?)

I would have expected being able to choose the upload destination from the 
upload dialog! I.e. using a radio button public/private folder

Is there anyone, who can point out, how to restrict access to media files in 
D7? Is any (easy to read) documentation available to get the big picture? 

Any help appreciated!

Kind regards, Marco